OAuth addresses these issues by introducing an authorization layer and separating the role of the client from that of the resource owner. In OAuth, the client requests access to resources controlled by the resource owner and hosted by the resource server, and is issued a different set of credentials than those of the resource owner.
Instead of using the resource owner's credentials to access protected resources, the client obtains an access token -- a string denoting a specific scope, lifetime, and other access attributes. Access tokens are issued to third-party clients by an authorization server with the approval of the resource owner. The client uses the access token to access the protected resources hosted by the resource server.
理解：
传统的做法是：resource owner（用户）将自己的credentials（用户名和密码）公开给client（第三方应用程序），例如：用QQ邮箱管理126邮箱，就需要把126邮箱的账户和密码告诉QQ邮箱。
OAuth的做法：client通过OAuth在resource owner的授权的情况下获取一个access token（临时证书），然后用这个access token访问resource server中的resource。